Multiple XSS Vulnerabilities in JetBrains YouTrack Due to Insecure Markdown Parsing
CVE-2024-50580

5.4MEDIUM

Key Information:

Vendor

Jetbrains
Status
Youtrack
Vendor
CVE Published:
28 October 2024

What is CVE-2024-50580?

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in JetBrains YouTrack due to insecure handling of markdown parsing and custom rendering rules. These flaws can allow an attacker to execute arbitrary scripts in the context of a user's session, potentially leading to data theft and other security breaches. It is imperative for users to exercise caution and implement necessary security measures to mitigate these risks.

References

https://www.jetbrains.com/privacy-security/issues-fixed/

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2024-50580 : Multiple XSS Vulnerabilities in JetBrains YouTrack Due to Insecure Markdown Parsing